What is new in Inventoros

Inventoros v1.0.3 — Security & Reliability

Implements every actionable finding from the 2026-06-03 security + reliability audit, each with regression tests. Full test suite green (1255 tests); cPanel package is now signed.

Security

• Plugin slug path containment (reject traversal/separators + realpath-contained deletes)
• GraphQL category/location references scoped to the caller's organization (IDOR)
• Update-availability check requires admin; backup filenames validated against an allowlist + the known-backup set
• GraphQL free-text length caps to match REST
• SSRF guard fails closed on empty DNS in production
• Nonce-based Content-Security-Policy (Vite + Ziggy nonce, vue-i18n JIT); deprecated X-XSS-Protection removed
• Plugin manifest guard + a startup warning when uploads are enabled without signature verification

Reliability / data integrity

• Shared, locked cancel-restock across web/REST/GraphQL (GraphQL no longer leaks stock on cancel)
• Transactions + row locks + status re-checks on PO receiving, work-order complete/cancel, stock-audit complete, web order cancel, and return receive
• Org-scoped, fail-fast product lookup in web order updates
• Stock notifications deferred until after the locked transaction commits
• All advertised webhook events now actually dispatch (stock, order, and purchase-order lifecycle)
• In-app updater auto-restores from backup if file replacement fails
• Product imports retry transient failures and keep the upload until the final attempt

Signed updates

Release archives are now signed with a detached Ed25519 signature (inventoros-cpanel-1.0.3.zip.sig). The in-app updater verifies the archive against the public key shipped in .env.example before extracting. Set INVENTOROS_UPDATE_PUBLIC_KEY (already in .env.example); to install unsigned builds set INVENTOROS_UPDATE_SIGNATURE_REQUIRED=false.

Known limitation

Stock transfers between locations remain a no-op audit record (global stock model); per-location stock tracking is a future change.

See INSTALL.md inside the zip for cPanel installation steps.

Inventoros v1.0.2

cPanel Installation Package

This release includes a pre-built package optimized for cPanel shared hosting.

Download: inventoros-cpanel-1.0.2.zip

See INSTALL.md inside the zip for installation instructions.

What's Included

• Pre-compiled frontend assets (no npm required on server)
• Production-optimized Composer dependencies
• cPanel-compatible directory structure
• Modified index.php for split directory setup

Inventoros v1.0.1B-CPANEL

cPanel Installation Package

This release includes a pre-built package optimized for cPanel shared hosting.

Download: inventoros-cpanel-1.0.1B-CPANEL.zip

See INSTALL.md inside the zip for installation instructions.

What's Included

• Pre-compiled frontend assets (no npm required on server)
• Production-optimized Composer dependencies
• cPanel-compatible directory structure
• Modified index.php for split directory setup

Inventoros v1.0.0B-CPANEL-B

cPanel Installation Package

This release includes a pre-built package optimized for cPanel shared hosting.

Download: inventoros-cpanel-1.0.0B-CPANEL-B.zip

See INSTALL.md inside the zip for installation instructions.

What's Included

• Pre-compiled frontend assets (no npm required on server)
• Production-optimized Composer dependencies
• cPanel-compatible directory structure
• Modified index.php for split directory setup

We’re officially launching Inventoros v1.0BETA — our first public milestone in reshaping the open-source inventory and warehouse management landscape.

⚠️ Active Development Disclaimer: Inventoros is still in early-stage development. Core features are functional, but APIs, UI flows, and plugin behavior remain fluid as we stabilize for production readiness. Early adopters and contributors are encouraged to jump in, test, and provide feedback as we harden the platform.

Vision: To democratize warehouse and inventory management by giving small and medium-sized businesses enterprise-grade power wrapped in a developer-friendly, extensible framework.

Highlights in 1.0BETA

✅ Full CRUD product & order management with auto-inventory sync

✅ Role-based access control and multi-user architecture

✅ Plugin-ready system with hooks and filters

✅ Installer wizard with environment validation

✅ Multi-currency and responsive dark-mode UI

🚧 CSV import/export and analytics dashboards in active development

Stack: Laravel 12 · Inertia.js · Vue 3 · Vite · MySQL